Description

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T22:17:24.233Z",
  "pubdate": "2026-08-17T22:17:24.233Z",
  "executiveSummary": "This advisory details a denial of service vulnerability affecting Safari, specifically triggered by the processing of maliciously crafted web content.\nThe vulnerability leads to an unexpected application crash, impacting availability for users browsing untrusted or malicious websites.\nAffected products and versions include iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, and macOS Tahoe 26.6.2.\nThe risk implication is primarily localized application instability and potential disruption of user workflows, reducing overall system reliability when rendering hostile inputs.\nAn attacker requires the capability to deliver or host maliciously crafted web content, such as through a compromised or attacker-controlled website, and induce a victim to process it within the vulnerable browser.\nNo specific authentication or elevated privileges are required by the attacker beyond the ability to present malicious web content to the targeted system.",
  "technicalDetails": "The root cause of the vulnerability stems from improper state management within the browser engine when handling specific sequences or structures of web content.\nWhen Safari parses and processes maliciously crafted web content, the flawed state handling logic leads to an unhandled exception, memory corruption, or invalid pointer dereference within the rendering or processing pipeline.\nThe vulnerable component is responsible for maintaining application state during the parsing, layout, or execution phases of web rendering.\nExploitation occurs when an attacker delivers a specially crafted payload via HTTP/HTTPS, typically hosted on a remote web server or injected through a compromised cross-site scripting vector, which is subsequently loaded and parsed by the victim's instance of Safari.\nUpon ingestion of the malformed web content, the internal state machine transitions into an inconsistent or invalid condition.\nThe application fails to gracefully recover from this state anomaly, resulting in an immediate and unexpected crash of the Safari process.\nThe attack flow requires network exposure via standard web browsing protocols, allowing external web resources to be fetched and processed.\nNo authentication or user privileges are required for the initial delivery phase, as standard web content is accessible to any browsing client.\nThe post-exploitation impact is strictly bounded to a denial of service condition affecting the browser instance, terminating active sessions and interrupting user interaction without providing direct remote code execution capabilities based on the provided disclosure."
}